support cards which only have ALG_RSA_CRT#5

Open

fishsoupisgood wants to merge 1 commit intomakinako:masterfrom

fishsoupisgood:alg_rsa_crt_support

fishsoupisgood commented Feb 25, 2018

None of the smartcards I tried (various JavaCOS, NXP, SmartCafe Expert) supported KeyPair(KeyPair.ALG_RSA, ...) only KeyPair.ALG_RSA_CRT.

This patch detects that and switches to using KeyPair.ALG_RSA_CRT.


          support cards which only have ALG_RSA_CRT

8adcbcf

darconeous reviewed

View reviewed changes

darconeous left a comment

I'm not associated with this project, but I had a look over the changes and figured I would throw in my $0.02. Take it with a grain of salt.

You may want to consider gating this capability by adding a feature flag.

Now that you added support for RSAPrivateCrtKey, consider implementing all of the types (ELEMENT_RSA_P, ELEMENT_RSA_Q, etc.) that RSAPrivateCrtKey seems to support:

OpenFIPS201/src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

Lines 108 to 133 in 8adcbcf

    
                   /* 
        
                   // RSA Prime Exponent P 
        
                   case ELEMENT_RSA_P: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA Prime Exponent Q 
        
                   case ELEMENT_RSA_Q: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA D mod P - 1 
        
                   case ELEMENT_RSA_DP: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA D mod Q - 1 
        
                   case ELEMENT_RSA_DQ: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   // RSA Inverse Q 
        
                   case ELEMENT_RSA_PQ: 
        
                   	if (privateKey == null) allocate(); 
        
                   	break; 
        
                   */

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

                   public void setPrivateExponent(byte[] buffer, short offset, short length) {
                       if (privateKey == null) allocate();
-                      privateKey.setExponent(buffer, offset, length);
+                      ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);

darconeous Dec 11, 2019

Given the next few lines, I'm guessing this line was included in error.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

               public final class PIVKeyObjectPKI extends PIVKeyObject {
-                  private RSAPrivateKey privateKey;
+                  private Key privateKey;

darconeous Dec 11, 2019

Instead of Key, should this be PrivateKey?

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

                   public void setModulus(byte[] buffer, short offset, short length) {
                       if (privateKey == null || publicKey == null) allocate();
-                      privateKey.setModulus(buffer, offset, length);
+                      ISOException.throwIt(ISO7816.SW_FUNC_NOT_SUPPORTED);

darconeous Dec 11, 2019

Same comment as that from line 156 above: I'm guessing this line was added in error.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

+                          try {
+                              keyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_1024);
+                          } catch (CryptoException e) {
+              	        if (e.getReason() == CryptoException.NO_SUCH_ALGORITHM) {

darconeous Dec 11, 2019

Inconsistent whitespace.

src/com/makina/security/OpenFIPS201/PIVKeyObjectPKI.java

+                          try {
+                              keyPair = new KeyPair(KeyPair.ALG_RSA, KeyBuilder.LENGTH_RSA_2048);
+                          } catch (CryptoException e) {
+              	        if (e.getReason() == CryptoException.NO_SUCH_ALGORITHM) {

darconeous Dec 11, 2019

Inconsistent whitespace.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet